Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in tizen-webdriver-cli (npm)

The npm package tizen-webdriver-cli contained malicious code in its postinstall lifecycle script that collected host identifiers and exfiltrated them to an attacker-controlled endpoint. The package name suggests a dependency-confusion attack targeting the legitimate Tizen WebDriver project.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All npm users who installed tizen-webdriver-cli during the malicious period.
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • tizen-webdriver-clinpm package containing malicious postinstall script

The npm package tizen-webdriver-cli was found to contain malicious code embedded in its postinstall lifecycle script. Upon installation, the script unconditionally collected host identifiers including hostname, platform, architecture, Node.js version, package name, and npm lifecycle event, then exfiltrated this data via HTTPS POST to a hardcoded attacker-controlled endpoint at https://8kq1s58l.instances.poc.jchunt.top/tizen-webdriver-cli.

The malicious behavior executed silently with a 3-second timeout and suppressed errors, leaving no visible trace in normal install output. There was no opt-in mechanism, user disclosure, or legitimate relationship between the destination host and the package's advertised purpose as a Tizen WebDriver CLI tool.

The package name closely resembles the legitimate shaka-project generic-webdriver-server Tizen backend, indicating a likely dependency-confusion attack designed to intercept installations of the genuine project. The incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • tizen-webdriver-cli
Domains
  • 8kq1s58l.instances.poc.jchunt.top

Remediation

  • Remove tizen-webdriver-cli from all environments and dependency manifests
  • Audit npm install logs and package-lock.json files to identify when the malicious package was installed
  • Review host identifiers (hostname, IP addresses, Node.js versions) that may have been exfiltrated
  • Use npm audit to scan for the malicious package in project dependencies
  • Implement package verification and allowlisting policies to prevent dependency-confusion attacks
  • Monitor for similar typosquatting attempts targeting legitimate Tizen WebDriver projects

Sources

  1. GitHub Advisory GHSA-cffv-ggq7-fw2q · GitHub Advisory Database

Cite this entry

"Malicious code in tizen-webdriver-cli (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-tizen-webdriver-cli-npm-1lxatl

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package